Re: [Fwd: Re: kern/118258 sysctl causing panics on 7.0-xxx]

On Thu, 3 Jan 2008, John Baldwin wrote:
> On Thursday 29 November 2007 10:53:32 pm Tai-hwa Liang wrote:
>> On Wed, 28 Nov 2007, Remko Lodder wrote:
>>> Hello,
>>>
>>> So as per Jeff's information, can someone from the -current
>>> list either contact jeff or try to resolve the problems
>>> mentioned? :)
>>
>>    This is a longstanding bug which also exists in RELENG_6.  It turns out
>> that 'sysctl kern.ttys' after a terminal device is removed could trigger
>> this panic reliably.  For example, do 'sysctl kern.ttys' multiple times
>> after detaching an USB serial-to-rs232 cable or a PCMCIA modem card.
>>
>>    Alternatively, following script would demo the panic if you don't have
>> a physically removable terminal device:
>>
>> #!/bin/sh
>> #
>> # Warning! Running this script as root will panic your CURRENT box...
>> #
>> while true; do
>>  	kldload dcons
>>  	kldunload dcons
>>  	ls /dev
>>  	sysctl kern.ttys
>>  	sleep 1
>> done
>>
>>    This seems to be a race between devfs and destroy_dev(), Cc'ing kib_at_
>> since he probably has more clues in this area.
>
> Try this patch.  Also available at
> http://www.FreeBSD.org/~jhb/patches/ttys_sysctl.patch

   With this patch, -CURRENT no longer boots and panics as follows:

Unread portion of the kernel message buffer:
<118>Configuring syscons:
<118> keyrate
Sleeping thread (tid 100048, pid 307) owns a non-sleepable lock
sched_switch(c3b97a50,0,1,394c04af,12,...) at sched_switch+0x146
mi_switch(1,0,c3b97a50,f888caa8,c051788a,...) at mi_switch+0x137
sleepq_switch(c3b97a50,0,c06945ef,19b,c065bdc0,...) at sleepq_switch+0x7e
sleepq_catch_signals(0,c3b97a50,f888cae8,c04b38d0,c3c999a8,...) at sleepq_catch_signals+0x24a
sleepq_wait_sig(c3c999a8,c3c99990,c0694a50,101,0,...) at sleepq_wait_sig+0x15
_cv_wait_sig(c3c999a8,c3c99990,c103c800,0,f888cb74,...) at _cv_wait_sig+0x180
seltdwait(c3f551d4,1,c3a9f200,c3b97a50,c3f59e58,...) at seltdwait+0xd6
poll(c3b97a50,f888ccfc,c,12,88cd2c,...) at poll+0x489
syscall(f888cd38) at syscall+0x317
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (209, FreeBSD ELF32, poll), eip = 0x28112baf, esp = 0xbfbfee1c, ebp = 0xbfbfee48 ---
panic: sleeping thread
KDB: enter: panic
panic: from debugger
Uptime: 8s
Physical memory: 1014 MB
Dumping 55 MB: 40 24 8

#0  doadump () at pcpu.h:195
195	pcpu.h: No such file or directory.
 	in pcpu.h
(kgdb) where
#0  doadump () at pcpu.h:195
#1  0xc04ea575 in boot (howto=260) at ../../../kern/kern_shutdown.c:417
#2  0xc04ea797 in panic (fmt=Variable "fmt" is not available.
) at ../../../kern/kern_shutdown.c:571
#3  0xc0446da7 in db_panic (addr=Could not find the frame base for "db_panic".
) at ../../../ddb/db_command.c:444
#4  0xc044751c in db_command (last_cmdp=0xc06dd754, cmd_table=0x0, dopager=1)
     at ../../../ddb/db_command.c:411
#5  0xc044762a in db_command_loop () at ../../../ddb/db_command.c:464
#6  0xc044908d in db_trap (type=3, code=0) at ../../../ddb/db_main.c:228
#7  0xc0510034 in kdb_trap (type=3, code=0, tf=0xf88df8dc)
     at ../../../kern/subr_kdb.c:510
#8  0xc0667bc7 in trap (frame=0xf88df8dc) at ../../../i386/i386/trap.c:647
#9  0xc065584b in calltrap () at ../../../i386/i386/exception.s:146
#10 0xc051019a in kdb_enter (why=0xc0692272 "panic", msg=0xc0692272 "panic")
     at cpufunc.h:60
#11 0xc04ea77d in panic (fmt=0xc06949df "sleeping thread")
     at ../../../kern/kern_shutdown.c:555
#12 0xc051a34d in propagate_priority (td=0xc3b97a50)
     at ../../../kern/subr_turnstile.c:222
#13 0xc051ad59 in turnstile_wait (ts=0xc3a9b870, owner=0xc3b97a50, queue=Variable "queue" is not available.)
     at ../../../kern/subr_turnstile.c:739
#14 0xc04dcedd in _mtx_lock_sleep (m=0xc06f7640, tid=3290042896, opts=0,
     file=0x0, line=0) at ../../../kern/kern_mutex.c:404
#15 0xc0529ead in ttyrel (tp=0xc3c88c00) at ../../../kern/tty.c:2855
#16 0xc052c08a in tty_close (tp=0xc3c88c00) at ../../../kern/tty.c:346
#17 0xc048d9ff in scclose (dev=0xc3c87100, flag=1, mode=8192, td=0xc41a1210)
     at ../../../dev/syscons/syscons.c:585
#18 0xc04b55d3 in giant_close (dev=0xc3c87100, fflag=1, devtype=8192,
     td=0xc41a1210) at ../../../kern/kern_conf.c:327
#19 0xc0493353 in devfs_close (ap=0xf88dfaac)
     at ../../../fs/devfs/devfs_vnops.c:372
#20 0xc06717f2 in VOP_CLOSE_APV (vop=0xc06b8160, a=0xf88dfaac)
     at vnode_if.c:424
#21 0xc0574cf7 in vn_close (vp=0xc423e000, flags=1, file_cred=0xc3a9f200,
     td=0xc41a1210) at vnode_if.h:228
#22 0xc0574e34 in vn_closefile (fp=0xc3f563dc, td=0xc41a1210)
     at ../../../kern/vfs_vnops.c:872
#23 0xc0491ae9 in devfs_close_f (fp=0xc3f563dc, td=0xc41a1210)
     at ../../../fs/devfs/devfs_vnops.c:384
#24 0xc04b8f73 in _fdrop (fp=0xc3f563dc, td=0xc41a1210) at file.h:268
#25 0xc04ba458 in closef (fp=0xc3f563dc, td=0xc41a1210)
     at ../../../kern/kern_descrip.c:1945
#26 0xc04bb4f5 in fdfree (td=0xc41a1210) at ../../../kern/kern_descrip.c:1655
#27 0xc04c7235 in exit1 (td=0xc41a1210, rv=0) at ../../../kern/kern_exit.c:271
#28 0xc04c85bd in sys_exit (td=Could not find the frame base for "sys_exit".
) at ../../../kern/kern_exit.c:98
#29 0xc0667407 in syscall (frame=0xf88dfd38) at ../../../i386/i386/trap.c:1034
#30 0xc06558b0 in Xint0x80_syscall () at ../../../i386/i386/exception.s:203
#31 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

-- 
Thanks,

Tai-hwa Liang